What is the CVSS score of CVE-2026-24208?

CVE-2026-24208 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Triton Inference Server CVE-2026-24208

EUVD-2026-31052 MEDIUM

Path Traversal (CWE-22)

2026-05-20 nvidia

GHSA-q9w5-fmq7-c9x3

Denial Of Service Nvidia Path Traversal

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 04:04 vuln.today

DescriptionCVE.org

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue. A successful exploit of this vulnerability might lead to denial of service.

AnalysisAI

Path traversal exploitation in NVIDIA Triton Inference Server enables unauthenticated remote attackers to cause denial of service by submitting crafted requests containing malicious path components. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero authentication or user interaction is required, making this broadly reachable from the network with low attack complexity. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; however, the no-prerequisite attack profile warrants patching per NVIDIA's advisory at nvidia.custhelp.com.

Technical ContextAI

NVIDIA Triton Inference Server is an open-source, production-grade ML inference serving platform designed to deploy and serve AI models at scale, commonly exposed via HTTP/gRPC endpoints in cloud and on-premises ML infrastructure. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal), a class of vulnerability where user-supplied input is incorporated into filesystem path construction without adequate canonicalization or boundary enforcement. In Triton's case, the traversal does not result in file disclosure (C:N, I:N in CVSS) but instead triggers a condition - such as an unhandled exception, resource exhaustion, or invalid path dereference - that degrades or terminates the inference service. The CPE string cpe:2.3:a:nvidia:triton_inference_server:*:*:*:*:*:*:*:* uses a wildcard version field, indicating NVD has not bounded the affected range to specific releases, implying broad version exposure.

RemediationAI

Consult and apply the guidance in the NVIDIA security advisory at https://nvidia.custhelp.com/app/answers/detail/a_id/5828, which is the authoritative source for fixed versions and official mitigations. No specific patched release version was present in the available intelligence, so exact upgrade targets should be confirmed directly from that advisory before deployment. As a compensating control pending patch application, restrict network access to Triton Inference Server API endpoints (default HTTP port 8000, gRPC port 8001) to trusted internal hosts or authenticated proxies only - this directly limits the attack surface given the AV:N/PR:N vector. Note that network-layer restrictions may not be feasible in public-facing inference deployments and do not address the root cause. Input validation at an API gateway or reverse proxy to reject requests containing path traversal sequences ('../', '%2e%2e%2f') is an additional layer but carries risk of false positives affecting legitimate model or repository path parameters.